The Health and Insurance Review & Assessment Service has come under fire after a lawmaker revealed that the state-run body allegedly sold personal health and medical data to private insurance companies.

According to Rep. Jung Choun-sook of the ruling Democratic Party who received a report from the HIRA, the state agency sold 52 “sample data sets” to eight private insurers and two private insurance research institutes from July 2014 to August 2017.

Each data set was priced at 300,000 won ($267). The eight insurance firms are AIA Life Korea, KB Life Insurance, KB Insurance, Lotte Non-Life Insurance, Mirae Asset Life Insurance, Hyundai Life Insurance, Heungkuk Fire and Marine Insurance and SCOR Korea, and the two private think tanks are Korea Insurance Development Institute and the Korea Insurance Research Institute.

Before providing the standard data sets, the HIRA received written pledges from the private insurers that they will not use the data for any other purpose than academic studies.

However, when a private insurance company requested such data for business purposes such as “development of the company’s risk ratio,” the HIRA went ahead and sold the data.

KB Life Insurance purchased the data for “calculating a risk ratio to study and develop an insurance product.” Hyundai Life Insurance requested and received the data from the HIRA for “developing the company’s risk ratio.”

However, the National Health Insurance Service, owning the same data with the HIRA, does not provide any standard data set to a private insurance company. The NHIS says it is because “private insurers might make bad use of people’s health insurance and medical data to discriminate against certain subscribers with certain diseases, previous records of having a disease or other risk factors."

HIRA’s sale of individual health data immediately met with severe criticism from the medical industry and civic groups who called the act, “big data business.”

The People’s Solidarity for Participatory Democracy and the Free Health Care Campaign Center said that the government should reconsider its push for big data business in the public healthcare at a news conference in Seoul, Monday.

The previous Park Geun-hye administration announced guidelines in June 2016 to de-identify personal information to facilitate the big data industry and allow such information to be used and distributed without the information owner’s consent, on the condition that the information is reformatted with pseudonymization, anonymization, and data suppression.

“HIRA’s absurd leakage of personal information is just a tip of an iceberg. Evils from the public healthcare big data projects, which were recklessly carried out for the past several years, have not surfaced enough yet,” they said. “The big data project in the public healthcare system should be thoroughly re-considered to check its purpose, safety, and effectiveness.”

The Health Right Network, the Citizens’ Coalition for Economic Justice and the Korea Organization for Patients’ Group also released a joint statement, saying private insurance companies want to purchase health information of their subscribers because they want to use it to block subscriptions from certain people and refuse to pay insurance benefits.

“HIRA sold the big data on health to the private insurers and helped them make profits,” they said.

A group from the medical industry even claimed that HIRA should be legally responsible for selling the information.

“HIRA should apologize to the public for selling their medical information to for-profit insurers,” the Korean Medical Association, a group of physicians, said. The KMA demanded an investigation by the prosecutors.

The Korea Medical Clinic Association also said, “HIRA has become the first state-run institution in the world to sell patients’ medical information to private insurance companies,” also demanding it to take legal responsibility.